https://issues.apache.org/bugzilla/show_bug.cgi?id=48948
Summary: ap_construct_url API function does not handle
malformed HOST request header
Product: Apache httpd-2
Version: 2.2.3
Platform: PC
OS/Version: Linux
Status: NEW
Severity: normal
Priority: P2
Component: Core
AssignedTo: [email protected]
ReportedBy: [email protected]
The ap_construct_url core API function does not properly handle the case where
a request specifies a 'HOST' HTTP request header with malformed data.
To reproduce this bug, I use CURL in the following manner:
curl -H "Host:foo.com, foo.com" http://foo.com/something.html
A module that I've written to pre-process requests invokes the ap_construct_url
function in the following way:
char *inferred_url = ap_construct_url(req->pool, req->uri, req);
In my experience, the value of inferred_url is invariably:
http://foo.com, foo.com/something.html
I know that it's incorrect for hosts to supply multiple values for the HOST
request parameter. But I have seen this occur. In any case, Apache should
handle it differently. It might:
(a) tokenize the HOST parameter by comma and use the first token value
(b) use some other source for the hostname given in the request
(c) indicate an error
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
